[Outcome][RM-001] Appliance lifecycle is trustworthy

[kaw393939]

Outcome

Deliver RM-001: a nontechnical owner can initialize, start, inspect, restart, and shut down one Ordo appliance while storage, readiness, degraded dependencies, diagnostics, and unfinished work remain truthful.

Canonical sources

• Structured roadmap
• Operations and security architecture
• Appliance runtime architecture
• Current state

Acceptance summary

• Clean-host initialization, SQLite WAL storage, health, readiness, restart, graceful shutdown, and interrupted-shutdown recovery are proven.
• Optional providers can be unavailable without making the core appliance unavailable.
• CLI and owner-visible status call the same application services and report the same state.
• Positive, negative, recovery, and seeded human-review evidence pass.

Activation rule

This queued outcome is blocked by #11 and #12. It has no milestone and grants no implementation authority until CURRENT-STATE.yaml activates RM-001 and a revision-bound JIT packet is approved.